7 Ways to Secure Your OpenVPN Server

If you’re running your own OpenVPN server, you’ll want to ensure it’s as secure as possible. After all, a VPN is only as secure as the server it’s running on, and a compromised VPN server can put your data and privacy at risk. In this post, we’ll explore seven ways to secure your OpenVPN server to keep your VPN solution safe and reliable.

Key points

Use strong passwords: One of the most basic yet effective ways to secure your OpenVPN server is by using strong, unique passwords for all your user accounts. Include the primary administrator (root) account and any additional user accounts you create.

Enable two-factor authentication: Another simple but effective security measure is enabling two-factor authentication (2FA) for all your user accounts. 2FA requires users to enter a second code, typically sent to their phone or generated by an authentication app, in addition to their password when logging in.

Use a firewall: A firewall is a critical security tool that can help protect your OpenVPN server from external threats. You can use a software firewall, such as iptables or ufw, or a hardware firewall, such as a router or network firewall appliance.

To allow OpenVPN connections to your server using iptables, you can use the following rules:

iptables -A INPUT -p udp --dport 1194 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
sudo ufw allow 1194/udp
sudo ufw allow 22/tcp
sudo ufw enable && sudo ufw status

Note that these rules are just a starting point, and you may need to modify them to fit your specific configuration and needs. It’s also essential to ensure that you have a default DROP policy for all incoming connections to secure your server further.

Enable encryption

OpenVPN uses SSL/TLS encryption by default to secure the connection between the client and server. However, it’s vital to ensure that you’re using robust encryption algorithms and keys to maximize the security of your VPN connection.

The encryption settings of a VPN can affect the speed of the traffic passing through the VPN connection. More robust encryption protocols and longer encryption keys will provide greater security. Still, they may also result in slower speeds due to the increased processing power and time required to encrypt and decrypt the data.

For example, a 256-bit encryption key will provide more robust security than a 128-bit key. Still, it may also result in slower speeds due to the increased computational effort required to encrypt and decrypt the data. Similarly, a more complex encryption protocol, such as AES-256, may provide more robust security but result in slower speeds than a more straightforward protocol, such as AES-128. At AstroVPN, we recommend AES-256-GCM encryption as a stable solution for high security and minimum bandwidth effects.

It’s crucial to balance the need for strong encryption with the need for fast speeds when configuring your VPN’s encryption settings. You may need to experiment with different encryption protocols and key combinations to find the best balance for your specific needs. It’s also worth noting that other factors, such as the distance between the client and server and the overall performance of the VPN server, can also impact traffic speeds.

Determine logging strategy

Enabling logging can help you track and monitor activity on your OpenVPN server, including user logins, connection attempts, and other important events. Logging can help detect and respond to potential security issues.

Understand the potential risks, however, of enabling logging on your OpenVPN server. OpenVPN (and many applications) allow you to control the “verbosity” of record keeping, allowing you to better control what is recorded and what is not.

To implement a zero-logging approach in OpenVPN, you can adjust the server configuration file server.conf. Here's an example of how to do this by modifying the verb and log settings:

verb 0
log /dev/null

Use certificate-based authentication

In addition to passwords and two-factor authentication, you can also use certificate-based authentication to secure your OpenVPN server. This method requires users to present a digital certificate to authenticate and establish a VPN connection. This can provide an extra layer of security, as you can configure the certificate only to allow access to specific users or devices. To implement certificate-based authentication, you’ll need to set up a public key infrastructure (PKI) and issue digital certificates to your users. PKIs can be a more complex process, but they can offer enhanced security for your VPN server.

Keep your server and software up to date! Please!

It’s essential to keep your OpenVPN server and any associated software up to date with the latest security patches and updates. Up-to-date software helps prevent vulnerabilities and exploits that a bad actor could use to compromise your server.

apt install unattended-upgrades -y
dpkg-reconfigure unattended-upgrades

Furthermore, it's important to consider vulnerability scanning and alerting software to ensure you're up to date with modern CVEs and take action appropriately. You can learn about the CVEs we often deal with at AstroVPN by reading our Security Report.

By following these seven tips, you can help to secure your OpenVPN server and ensure that your self-hosted VPN solution remains safe and reliable. While you cannot 100% guarantee the security of your server, you can implement these measures to significantly reduce the risk of a data breach and protect your data and privacy. So, it is always better to be proactive and take necessary precautions to keep your OpenVPN server secure.

Want to learn more about AstroVPN and the security efforts we put in place to protect our VPN infrastructure? Learn more at our website: https://astrovpn.co/